Red Hat Security Advisory: Red Hat AI Inference Server 3.3.6 (Spyre)

A flaw in vLLM allows unauthenticated attackers to cause denial of service by supplying image or video placeholder sequences without matching data, leading to unhandled errors and worker termination. Additionally, text-only prompts containing special tokens can be misinterpreted as control commands, causing unexpected behavior. This vulnerability affects Red Hat AI Inference Server 3.3.6 (Spyre) and related products. Red Hat has classified this as an important denial of service issue impacting service availability in AI inference workloads. No official patch or mitigation meeting Red Hat's standards is currently available.

The vulnerability enables unauthenticated attackers to disrupt service availability by causing worker termination in the AI inference server. This can degrade or halt AI inference workloads, impacting systems relying on Red Hat AI Inference Server and related integrations. There is no confidentiality or integrity impact reported.

No official fix or mitigation currently meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Customers with a Technical Account Manager (TAM) can consult directly for guidance. No immediate workaround is provided by Red Hat.